PT-2025-37512 · Brcmfmac+5 · Brcmfmac+5

Published 2022-12-22 · Updated 2025-10-23 · CVE-2022-50258

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description This issue resolves a stack-out-of-bounds read in brcmfmac that occurs when a null-terminated buffer is not passed as an argument of strsep() in the brcmf c preinit dcmds() function. The buffer is filled with a firmware version string by memcpy() in brcmf fil iovar data get(). The patch ensures the buffer is null-terminated. The vulnerability was found by a modified version of syzkaller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

ALSA-2025_16880

BDU:2026-02175

CESA-2023_7077

CVE-2022-50258

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:03613-1

SUSE-SU-2025:03614-1

SUSE-SU-2025:03615-1

SUSE-SU-2025:03626-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

Brcmfmac

References · 1013

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50258.json · Exploit
• https://git.kernel.org/stable/c/d6ef66194bb4a6c18f5b9649bf62597909b040e4 · Patch
• https://git.kernel.org/stable/c/d481fd6064bf215d7c5068e15aa390c3b16c9cd0 · Patch
• https://git.kernel.org/stable/c/ba166e0ebdde3dfa833f0a3edaf2b2934d4a87f7 · Patch
• https://git.kernel.org/stable/c/17dbe90e13f52848c460d253f15b765038ec6dc0 · Patch
• https://git.kernel.org/stable/c/3a3a5e3f94068cd562d62a57da6983c8cd07d53c · Patch
• https://ubuntu.com/security/CVE-2022-50258 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02175 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50258 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03626-1 · Vendor Advisory
• https://git.kernel.org/stable/c/881f50d76c3892262730ddf5c894eb00310e736c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50258 · Vendor Advisory
• https://git.kernel.org/stable/c/89243a7b0ea19606ba1c2873c9d569026ccb344f · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03628-1 · Vendor Advisory